program: timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x440081, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) dup2(r1, r2) vmsplice(r1, &(0x7f0000001180)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r3, &(0x7f0000000300)='vhci_hcd.0\x00', 0xb) fcntl$lock(r0, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10002, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(r4, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105b5e9f977", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r4, &(0x7f0000000480)=[{&(0x7f0000000180)=""/1, 0x1}], 0x1, 0x1, 0xd) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000006100)={0x2c, 0x3f, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0xc, 0x3, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x8, 0x2, 0x0, 0x1, [@nested={0x4, 0x14}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) ioctl$DVB_DEMUX_DMX_STOP(r4, 0x6f2a) [ 93.804521][ T5277] Bluetooth: hci0: command tx timeout [ 93.916551][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 93.935321][ T5314] usb usb7: USB disconnect, device number 1 [ 94.033992][ T1161] vhci_hcd vhci_hcd.0: stop threads [ 94.037747][ T5314] vhci_hcd vhci_hcd.0: USB bus 7 deregistered [ 94.044187][ T1161] vhci_hcd vhci_hcd.0: release socket [ 94.047381][ T1161] vhci_hcd vhci_hcd.0: disconnect device [ 94.054053][ T1161] vhci_hcd vhci_hcd.0: stop threads [ 94.059842][ T1161] vhci_hcd vhci_hcd.0: release socket [ 94.065881][ T1161] vhci_hcd vhci_hcd.0: disconnect device [ 94.071565][ T1161] vhci_hcd vhci_hcd.0: stop threads [ 94.076659][ T1161] vhci_hcd vhci_hcd.0: release socket [ 94.083089][ T1161] vhci_hcd vhci_hcd.0: disconnect device [ 94.088558][ T1161] vhci_hcd vhci_hcd.0: stop threads [ 94.096611][ T1161] vhci_hcd vhci_hcd.0: release socket [ 94.100516][ T5314] vhci_hcd vhci_hcd.0: remove, state 4 [ 94.103585][ T1161] ================================================================== [ 94.107056][ T1161] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x452/0x460 [ 94.110591][ T1161] Read of size 4 at addr ffff888034cf8b40 by task kworker/u4:10/1161 [ 94.114107][ T1161] [ 94.115205][ T1161] CPU: 0 UID: 0 PID: 1161 Comm: kworker/u4:10 Not tainted syzkaller #0 PREEMPT(full) [ 94.115227][ T1161] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.115235][ T1161] Workqueue: usbip_event event_handler [ 94.115253][ T1161] Call Trace: [ 94.115260][ T1161] [ 94.115265][ T1161] dump_stack_lvl+0xe8/0x150 [ 94.115282][ T1161] print_address_description+0x55/0x1e0 [ 94.115297][ T1161] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.115309][ T1161] print_report+0x58/0x70 [ 94.115320][ T1161] kasan_report+0x117/0x150 [ 94.115335][ T1161] ? vhci_cleanup_unlink_list+0x452/0x460 [ 94.115349][ T1161] vhci_cleanup_unlink_list+0x452/0x460 [ 94.115360][ T1161] ? kasan_quarantine_put+0xbb/0x1f0 [ 94.115373][ T1161] vhci_shutdown_connection+0x2af/0x650 [ 94.115387][ T1161] event_handler+0x2a4/0x4b0 [ 94.115398][ T1161] ? process_scheduled_works+0xa20/0x14e0 [ 94.115411][ T1161] process_scheduled_works+0xa8e/0x14e0 [ 94.115428][ T1161] ? __pfx_process_scheduled_works+0x10/0x10 [ 94.115442][ T1161] ? assign_work+0x3cf/0x5d0 [ 94.115453][ T1161] worker_thread+0xa47/0xfb0 [ 94.115469][ T1161] ? __kthread_parkme+0x71/0x1f0 [ 94.115484][ T1161] kthread+0x388/0x470 [ 94.115499][ T1161] ? __pfx_worker_thread+0x10/0x10 [ 94.115510][ T1161] ? __pfx_kthread+0x10/0x10 [ 94.115523][ T1161] ret_from_fork+0x514/0xb70 [ 94.115540][ T1161] ? __pfx_ret_from_fork+0x10/0x10 [ 94.115553][ T1161] ? __switch_to+0xc89/0x1420 [ 94.115567][ T1161] ? __pfx_kthread+0x10/0x10 [ 94.115581][ T1161] ret_from_fork_asm+0x1a/0x30 [ 94.115601][ T1161] [ 94.115605][ T1161] [ 94.182199][ T1161] Allocated by task 1: [ 94.184033][ T1161] kasan_save_track+0x3e/0x80 [ 94.185989][ T1161] __kasan_kmalloc+0x93/0xb0 [ 94.187975][ T1161] __kmalloc_noprof+0x375/0x720 [ 94.190376][ T1161] __usb_create_hcd+0x67/0x900 [ 94.192465][ T1161] vhci_hcd_probe+0x1e6/0x3e0 [ 94.194527][ T1161] platform_probe+0xf9/0x190 [ 94.196463][ T1161] really_probe+0x254/0xae0 [ 94.198326][ T1161] __driver_probe_device+0x1e8/0x360 [ 94.200524][ T1161] driver_probe_device+0x4f/0x240 [ 94.202644][ T1161] __device_attach_driver+0x270/0x410 [ 94.204866][ T1161] bus_for_each_drv+0x258/0x2f0 [ 94.206807][ T1161] __device_attach+0x2c4/0x450 [ 94.208821][ T1161] device_initial_probe+0xa1/0xd0 [ 94.210971][ T1161] bus_probe_device+0x12a/0x220 [ 94.212957][ T1161] device_add+0x7d7/0xb80 [ 94.214822][ T1161] platform_device_add+0x4bd/0x860 [ 94.217062][ T1161] platform_device_register_full+0x62d/0x710 [ 94.219528][ T1161] vhci_hcd_init+0x227/0x360 [ 94.221433][ T1161] do_one_initcall+0x250/0x870 [ 94.223478][ T1161] do_initcall_level+0x10a/0x1a0 [ 94.225677][ T1161] do_initcalls+0x59/0xa0 [ 94.228090][ T1161] kernel_init_freeable+0x29d/0x3e0 [ 94.230276][ T1161] kernel_init+0x1d/0x1d0 [ 94.232082][ T1161] ret_from_fork+0x514/0xb70 [ 94.234053][ T1161] ret_from_fork_asm+0x1a/0x30 [ 94.236117][ T1161] [ 94.237207][ T1161] Freed by task 5314: [ 94.238946][ T1161] kasan_save_track+0x3e/0x80 [ 94.240831][ T1161] kasan_save_free_info+0x40/0x50 [ 94.242829][ T1161] __kasan_slab_free+0x5c/0x80 [ 94.244855][ T1161] kfree+0x1c5/0x640 [ 94.246469][ T1161] vhci_hcd_remove+0x9e/0x110 [ 94.248425][ T1161] device_release_driver_internal+0x48b/0x880 [ 94.250866][ T1161] unbind_store+0x1a1/0x1d0 [ 94.252772][ T1161] kernfs_fop_write_iter+0x3a4/0x540 [ 94.254959][ T1161] vfs_write+0x612/0xba0 [ 94.256796][ T1161] ksys_write+0x150/0x270 [ 94.258645][ T1161] do_syscall_64+0x174/0x580 [ 94.260631][ T1161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.263250][ T1161] [ 94.264461][ T1161] Last potentially related work creation: [ 94.266776][ T1161] kasan_save_stack+0x3e/0x60 [ 94.268770][ T1161] kasan_record_aux_stack+0xbd/0xd0 [ 94.271052][ T1161] insert_work+0x3d/0x330 [ 94.273691][ T1161] __queue_work+0xcd8/0x10a0 [ 94.275724][ T1161] queue_work_on+0x106/0x1d0 [ 94.277705][ T1161] unlink1+0x344/0x3e0 [ 94.279512][ T1161] usb_hcd_unlink_urb+0xe6/0x1e0 [ 94.281571][ T1161] usb_kill_urb+0x10b/0x2f0 [ 94.283545][ T1161] hub_quiesce+0x211/0x330 [ 94.285377][ T1161] hub_suspend+0x904/0xad0 [ 94.287340][ T1161] usb_suspend_both+0x285/0x1040 [ 94.289344][ T1161] usb_runtime_suspend+0x58/0x110 [ 94.291411][ T1161] __rpm_callback+0x2c7/0x950 [ 94.293404][ T1161] rpm_suspend+0x8a0/0x17b0 [ 94.295301][ T1161] __pm_runtime_suspend+0x12f/0x1a0 [ 94.297539][ T1161] usb_new_device+0xaee/0x1690 [ 94.299607][ T1161] register_root_hub+0x250/0x5c0 [ 94.301755][ T1161] usb_add_hcd+0xac7/0xf80 [ 94.303801][ T1161] vhci_hcd_probe+0x1fa/0x3e0 [ 94.305787][ T1161] platform_probe+0xf9/0x190 [ 94.307764][ T1161] really_probe+0x254/0xae0 [ 94.309682][ T1161] __driver_probe_device+0x1e8/0x360 [ 94.311843][ T1161] driver_probe_device+0x4f/0x240 [ 94.314148][ T1161] __device_attach_driver+0x270/0x410 [ 94.316576][ T1161] bus_for_each_drv+0x258/0x2f0 [ 94.318606][ T1161] __device_attach+0x2c4/0x450 [ 94.320601][ T1161] device_initial_probe+0xa1/0xd0 [ 94.322772][ T1161] bus_probe_device+0x12a/0x220 [ 94.324914][ T1161] device_add+0x7d7/0xb80 [ 94.326695][ T1161] platform_device_add+0x4bd/0x860 [ 94.328817][ T1161] platform_device_register_full+0x62d/0x710 [ 94.331265][ T1161] vhci_hcd_init+0x227/0x360 [ 94.333317][ T1161] do_one_initcall+0x250/0x870 [ 94.335500][ T1161] do_initcall_level+0x10a/0x1a0 [ 94.337684][ T1161] do_initcalls+0x59/0xa0 [ 94.339504][ T1161] kernel_init_freeable+0x29d/0x3e0 [ 94.341695][ T1161] kernel_init+0x1d/0x1d0 [ 94.343953][ T1161] ret_from_fork+0x514/0xb70 [ 94.346068][ T1161] ret_from_fork_asm+0x1a/0x30 [ 94.348169][ T1161] [ 94.349208][ T1161] Second to last potentially related work creation: [ 94.352002][ T1161] kasan_save_stack+0x3e/0x60 [ 94.354057][ T1161] kasan_record_aux_stack+0xbd/0xd0 [ 94.356418][ T1161] insert_work+0x3d/0x330 [ 94.358199][ T1161] __queue_work+0xcd8/0x10a0 [ 94.360186][ T1161] queue_work_on+0x106/0x1d0 [ 94.362135][ T1161] usb_hcd_submit_urb+0xa3b/0x1b60 [ 94.364417][ T1161] usb_start_wait_urb+0x13f/0x5b0 [ 94.367239][ T1161] usb_control_msg+0x234/0x3e0 [ 94.369406][ T1161] hub_suspend+0x891/0xad0 [ 94.371805][ T1161] usb_suspend_both+0x285/0x1040 [ 94.374893][ T1161] usb_runtime_suspend+0x58/0x110 [ 94.377078][ T1161] __rpm_callback+0x2c7/0x950 [ 94.379121][ T1161] rpm_suspend+0x8a0/0x17b0 [ 94.381055][ T1161] __pm_runtime_suspend+0x12f/0x1a0 [ 94.383364][ T1161] usb_new_device+0xaee/0x1690 [ 94.385463][ T1161] register_root_hub+0x250/0x5c0 [ 94.387621][ T1161] usb_add_hcd+0xac7/0xf80 [ 94.389507][ T1161] vhci_hcd_probe+0x1fa/0x3e0 [ 94.391481][ T1161] platform_probe+0xf9/0x190 [ 94.393413][ T1161] really_probe+0x254/0xae0 [ 94.395361][ T1161] __driver_probe_device+0x1e8/0x360 [ 94.397747][ T1161] driver_probe_device+0x4f/0x240 [ 94.400385][ T1161] __device_attach_driver+0x270/0x410 [ 94.402610][ T1161] bus_for_each_drv+0x258/0x2f0 [ 94.404790][ T1161] __device_attach+0x2c4/0x450 [ 94.406669][ T1161] device_initial_probe+0xa1/0xd0 [ 94.408825][ T1161] bus_probe_device+0x12a/0x220 [ 94.410809][ T1161] device_add+0x7d7/0xb80 [ 94.412661][ T1161] platform_device_add+0x4bd/0x860 [ 94.414832][ T1161] platform_device_register_full+0x62d/0x710 [ 94.417322][ T1161] vhci_hcd_init+0x227/0x360 [ 94.419243][ T1161] do_one_initcall+0x250/0x870 [ 94.421232][ T1161] do_initcall_level+0x10a/0x1a0 [ 94.423310][ T1161] do_initcalls+0x59/0xa0 [ 94.425287][ T1161] kernel_init_freeable+0x29d/0x3e0 [ 94.427517][ T1161] kernel_init+0x1d/0x1d0 [ 94.429304][ T1161] ret_from_fork+0x514/0xb70 [ 94.431283][ T1161] ret_from_fork_asm+0x1a/0x30 [ 94.433348][ T1161] [ 94.434416][ T1161] The buggy address belongs to the object at ffff888034cf8000 [ 94.434416][ T1161] which belongs to the cache kmalloc-8k of size 8192 [ 94.440079][ T1161] The buggy address is located 2880 bytes inside of [ 94.440079][ T1161] freed 8192-byte region [ffff888034cf8000, ffff888034cfa000) [ 94.445969][ T1161] [ 94.447037][ T1161] The buggy address belongs to the physical page: [ 94.449758][ T1161] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34cf8 [ 94.453215][ T1161] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 94.457109][ T1161] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) [ 94.460215][ T1161] page_type: f5(slab) [ 94.461888][ T1161] raw: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.465421][ T1161] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.468957][ T1161] head: 04fff00000000040 ffff88801b042280 dead000000000122 0000000000000000 [ 94.472548][ T1161] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 94.476228][ T1161] head: 04fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 94.479792][ T1161] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 94.483327][ T1161] page dumped because: kasan: bad access detected [ 94.485954][ T1161] page_owner tracks the page as allocated [ 94.488253][ T1161] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 16841942927, free_ts 16825805589 [ 94.496626][ T1161] post_alloc_hook+0x1f9/0x250 [ 94.498572][ T1161] get_page_from_freelist+0x21fa/0x2270 [ 94.500886][ T1161] __alloc_frozen_pages_noprof+0x18d/0x380 [ 94.503870][ T1161] allocate_slab+0x79/0x5e0 [ 94.505757][ T1161] refill_objects+0x2d5/0x350 [ 94.507647][ T1161] __pcs_replace_empty_main+0x2bf/0x6b0 [ 94.509895][ T1161] __kmalloc_noprof+0x485/0x720 [ 94.512002][ T1161] __usb_create_hcd+0x67/0x900 [ 94.513961][ T1161] vhci_hcd_probe+0x104/0x3e0 [ 94.516036][ T1161] platform_probe+0xf9/0x190 [ 94.517877][ T1161] really_probe+0x254/0xae0 [ 94.519759][ T1161] __driver_probe_device+0x1e8/0x360 [ 94.521917][ T1161] driver_probe_device+0x4f/0x240 [ 94.523986][ T1161] __device_attach_driver+0x270/0x410 [ 94.526239][ T1161] bus_for_each_drv+0x258/0x2f0 [ 94.528227][ T1161] __device_attach+0x2c4/0x450 [ 94.530146][ T1161] page last free pid 1 tgid 1 stack trace: [ 94.532672][ T1161] __free_frozen_pages+0xc1e/0xd10 [ 94.535021][ T1161] __slab_free+0x274/0x2c0 [ 94.537000][ T1161] qlist_free_all+0x99/0x100 [ 94.538937][ T1161] kasan_quarantine_reduce+0x148/0x160 [ 94.541145][ T1161] __kasan_slab_alloc+0x22/0x80 [ 94.543139][ T1161] __kmalloc_cache_noprof+0x2ab/0x660 [ 94.545277][ T1161] device_create_with_groups+0x13d/0x300 [ 94.547740][ T1161] misc_register+0x2f7/0x560 [ 94.549819][ T1161] do_one_initcall+0x250/0x870 [ 94.551901][ T1161] do_initcall_level+0x10a/0x1a0 [ 94.554149][ T1161] do_initcalls+0x59/0xa0 [ 94.556020][ T1161] kernel_init_freeable+0x29d/0x3e0 [ 94.558300][ T1161] kernel_init+0x1d/0x1d0 [ 94.560074][ T1161] ret_from_fork+0x514/0xb70 [ 94.562125][ T1161] ret_from_fork_asm+0x1a/0x30 [ 94.564184][ T1161] [ 94.565182][ T1161] Memory state around the buggy address: [ 94.567556][ T1161] ffff888034cf8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.571228][ T1161] ffff888034cf8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.574588][ T1161] >ffff888034cf8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.577866][ T1161] ^ [ 94.580418][ T1161] ffff888034cf8b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.583678][ T1161] ffff888034cf8c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.586971][ T1161] ================================================================== [ 94.591720][ T5314] usb usb6: USB disconnect, device number 1 [ 94.632023][ T5314] vhci_hcd vhci_hcd.0: USB bus 6 deregistered